CVE-2026-87752

MediumCVSS 6.1

Published: 28/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Summary

A cross-site scripting (XSS) vulnerability in Agentis by Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. is caused by improper neutralization of input during web page generation. It allows XSS targeting HTML attributes.

Risk Assessment

An attacker can inject malicious code into HTML attributes, potentially leading to session theft or unwanted actions in the victim's browser. The vulnerability affects Agentis versions from 4.44 before 4.6.

Recommendation

Update Agentis to version 4.6 or later. Implement input validation and encoding in HTML attributes and consider using a Content-Security-Policy header.

Other vulnerabilities in Agentis

CVE-2026-100164High
An observable response discrepancy vulnerability in Agentis allows account footprinting. The issue affects versions before 4.8.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS